CVE-2024-0742
Published: 23 January 2024
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
Notes
Author | Note |
---|---|
tyhicks |
mozjs contains a copy of the SpiderMonkey JavaScript engine |
mdeslaur |
starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap |
Priority
Status
Package | Release | Status |
---|---|---|
firefox
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
focal |
Released
(122.0+build2-0ubuntu0.20.04.1)
|
|
jammy |
Not vulnerable
(code not present)
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
mantic |
Not vulnerable
(code not present)
|
|
noble |
Not vulnerable
(code not present)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Needs triage
|
|
xenial |
Ignored
(end of standard support)
|
|
mozjs102
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Ignored
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
mantic |
Ignored
(end of life, was needs-triage)
|
|
noble |
Ignored
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
|
|
xenial |
Does not exist
|
|
mozjs38
Launchpad, Ubuntu, Debian |
bionic |
Ignored
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
|
|
xenial |
Does not exist
|
|
mozjs52
Launchpad, Ubuntu, Debian |
bionic |
Ignored
|
focal |
Ignored
|
|
jammy |
Does not exist
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
|
|
xenial |
Does not exist
|
|
mozjs68
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Ignored
|
|
jammy |
Does not exist
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
|
|
xenial |
Does not exist
|
|
mozjs78
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Ignored
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
|
|
xenial |
Does not exist
|
|
mozjs91
Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
jammy |
Ignored
|
|
lunar |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
|
|
xenial |
Does not exist
|
|
thunderbird
Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
focal |
Released
(1:115.8.1+build1-0ubuntu0.20.04.1)
|
|
jammy |
Released
(1:115.8.1+build1-0ubuntu0.22.04.1)
|
|
lunar |
Ignored
(end of life, was needed)
|
|
mantic |
Released
(1:115.8.1+build1-0ubuntu0.23.10.1)
|
|
noble |
Not vulnerable
(code not present)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Released
(115.7)
|
|
xenial |
Ignored
(end of standard support)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 4.3 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
References
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-01/#CVE-2024-0742
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/#CVE-2024-0742
- https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/#CVE-2024-0742
- https://bugzilla.mozilla.org/show_bug.cgi?id=1867152
- https://www.mozilla.org/security/advisories/mfsa2024-01/
- https://www.mozilla.org/security/advisories/mfsa2024-02/
- https://www.mozilla.org/security/advisories/mfsa2024-04/
- https://ubuntu.com/security/notices/USN-6610-1
- https://ubuntu.com/security/notices/USN-6669-1
- https://www.cve.org/CVERecord?id=CVE-2024-0742
- NVD
- Launchpad
- Debian